Skip to content

Commit d7b1e2f

Browse files
committed
Merge branch 'release/v4.0.0-rc1'
2 parents ebcdaa8 + ea6c5de commit d7b1e2f

84 files changed

Lines changed: 7234 additions & 3278 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

CHANGELOG.md

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,30 +4,50 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
55
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
66

7-
## [Unreleased]
7+
## [4.0.0-rc1]
88
### Added
9-
- Options for Courier authlib authentication: courier_md5, courier_md5raw, courier_sha1, courier_sha256
10-
- crypt_type 'drupal' for Drupal 7 authentication
9+
- New hashing algorithms: Argon2 Crypt (PHP 7.2 and above), Blowfish Crypt, Courier base64-encoded MD5, Courier base64-encoded SHA1,
10+
Courier base64-encoded SHA256, Courier hexadecimal MD5, Extended DES Crypt, SHA256 Crypt,
11+
SHA512 Crypt, SSHA512, Standard DES Crypt
12+
- Option to allow users to change their display names
13+
- Option to allow user to change its avatar
14+
- Database query results cache
15+
- Option for group display name
16+
- Option for group is admin flag
17+
18+
### Changed
19+
- The whole core implementation, which is NOT COMPATIBLE with the previous versions.
20+
- Minimum supported PHP version - 7.0
21+
22+
## Removed
23+
- MySQL ENCRYPT() hashing implementation - Function is deprecated as of MySQL 5.7.6 and will be removed in a future MySQL release.
24+
- MySQL PASSWORD() hashing implementation - Function is deprecated as of MySQL 5.7.6 and will be removed in a future MySQL release.
25+
- Redmine hashing implementation - Cannot implement in new core system.
26+
- User active column - Use database view instead
27+
- Domain support
1128

1229
## [3.1.0] - 2018-02-06
1330
### Added
1431
- Column autocomplete for PostgreSQL
1532
- Currently supported parameters in README.md
1633
- SALT support for password algorithms "system" and "password_hash"
34+
1735
### Changed
1836
- Updated README.me file
1937
- Nextcloud 12 & 13 support
2038
- Moved files to be more on the standard places
2139
- Renamed some files to be more standard like
2240
- Source code changes to be more standard like (max 80 characters)
41+
2342
### Fixed
2443
- Column autocomplete in "Groups Settings"
2544
- Security fix for password length sniffing attacks
2645
- Small bug fixes
46+
2747
## Removed
2848
- Code for supervisor mode
2949

30-
## [2.4.0] - 2017-12-26
50+
## 2.4.0 - 2017-12-26
3151
### Added
3252
- This CHANGELOG.md file
3353
- Support for PHP 7
@@ -37,3 +57,6 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
3757

3858
### Changed
3959
- Supported version of ownCloud, Nextcloud: ownCloud 10, Nextcloud 12
60+
61+
[4.0.0-rc1]: https://github.com/nextcloud/user_sql/compare/v3.1.0...v4.0.0-rc1
62+
[3.1.0]: https://github.com/nextcloud/user_sql/compare/v2.4.0...v3.1.0

LICENCE.md

Lines changed: 614 additions & 0 deletions
Large diffs are not rendered by default.

README.md

Lines changed: 185 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -3,98 +3,213 @@ user_sql
33

44
**Nextcloud SQL user authentication.**
55

6-
![](https://github.com/nextcloud/user_sql/blob/master/screenshot.png)
6+
![screenshot](https://github.com/nextcloud/user_sql/blob/develop/img/screenshot.png)
7+
8+
Use external database as a source for Nextcloud users and groups.
9+
Retrieve the users and groups info. Allow the users to change their passwords.
10+
Sync the users' email addresses with the addresses stored by Nextcloud.
711

812
## Getting Started
9-
1. SSH into your server
1013

11-
2. Get into the apps folder of your Nextcloud installation, for example /var/www/nextcloud/apps
14+
1. SSH into your server.
1215

13-
3. Git clone this project
14-
```
15-
git clone https://github.com/nextcloud/user_sql.git
16-
```
16+
2. Get into the apps folder of your Nextcloud installation, for example */var/www/nextcloud/apps*.
17+
18+
3. Git clone this project: `git clone https://github.com/nextcloud/user_sql.git`.
19+
20+
4. Login to your Nextcloud instance as admin.
21+
22+
5. Navigate to Apps from the menu then find and enable the *User and Group SQL Backends* app.
23+
24+
6. Navigate to Admin from menu and switch to Additional Settings, scroll down the page and you will see *SQL Backends* settings.
25+
26+
*You can skip the first three steps as this app is available in the official [Nextcloud App Store](https://apps.nextcloud.com/apps/user_sql).*
27+
28+
## Configuration
29+
30+
Below are detailed descriptions of all available options.
31+
32+
#### Database connection
33+
34+
This section contains the database connection parameters.
35+
36+
Name | Description | Details
37+
--- | --- | ---
38+
**SQL driver** | The database driver to use. Currently supported drivers are: mysql, pgsql. | Mandatory.
39+
**Hostname** | The hostname on which the database server resides. | Mandatory.
40+
**Database** | The name of the database. | Mandatory.
41+
**Username** | The name of the user for the connection. | Optional.
42+
**Password** | The password of the user for the connection. | Optional.
43+
44+
#### Options
45+
46+
Here are all currently supported options.
47+
48+
Name | Description | Details
49+
--- | --- | ---
50+
**Allow display name change** | With this option enabled user can change its display name. The display name change is propagated to the database. | Optional.<br/>Default: false.<br/>Requires: user *Display name* column.
51+
**Allow password change** | Can user change its password. The password change is propagated to the database. See [Hash algorithms](#hash-algorithms). | Optional.<br/>Default: false.
52+
**Use cache** | Use database query results cache. The cache can be cleared any time with the *Clear cache* button click. | Optional.<br/>Default: false.
53+
**Hashing algorithm** | How users passwords are stored in the database. See [Hash algorithms](#hash-algorithms). | Mandatory.
54+
**Email sync** | Sync e-mail address with the Nextcloud.<br/>- *None* - Disables this feature. This is the default option.<br/>- *Synchronise only once* - Copy the e-mail address to the Nextcloud storage if its not set.<br/>- *Nextcloud always wins* - Always copy the e-mail address to the database. This updates the user table.<br/>- *SQL always wins* - Always copy the e-mail address to the Nextcloud storage. | Optional.<br/>Default: *None*.<br/>Requires: user *Email* column.
55+
**Home mode** | User storage path.<br/>- *Default* - Let the Nextcloud manage this. The default option.<br/>- *Query* - Use location from the user table pointed by the *home* column.<br/>- *Static* - Use static location. The `%u` variable is replaced with the username of the user. | Optional<br/>Default: *Default*.
56+
**Home Location** | User storage path for the `static` *home mode*. | Mandatory if the *Home mode* is set to `Static`.
57+
58+
#### User table
59+
60+
The definition of user table. The table containing user accounts.
61+
62+
Name | Description | Details
63+
--- | --- | ---
64+
**Table name** | The table name. | Mandatory for user backend.
65+
**Username** | Username column. | Mandatory for user backend.
66+
**Email** | E-mail column. | Mandatory for *Email sync* option.
67+
**Home** | Home path column. | Mandatory for `Query` *Home sync* option.
68+
**Password** | Password hash column. | Mandatory for user backend.
69+
**Display name** | Display name column. | Optional.
70+
**Can change avatar** | Flag indicating if user can change its avatar. | Optional.<br/>Default: false.
71+
72+
#### Group table
73+
74+
The group definitions table.
1775

18-
4. Login your Nextcloud as admin
76+
Name | Description | Details
77+
--- | --- | ---
78+
**Table name** | The table name. | Mandatory for group backend.
79+
**Is admin** | Flag indicating if its the admin group | Optional.
80+
**Display name** | Display name column. | Optional.
81+
**Group name** | Group name column. | Mandatory for group backend.
1982

20-
5. Navigate to Apps from the menu and enable the SQL user backend
83+
#### User group table
2184

22-
6. Navigate to Admin from menu and switch to Additional Settings, scroll down the page and you will see SQL User Backend settings
85+
Associative table which maps users to groups.
86+
87+
Name | Description | Details
88+
--- | --- | ---
89+
**Table name** | The table name. | Mandatory for group backend.
90+
**Username** | Username column. | Mandatory for group backend.
91+
**Group name** | Group name column. | Mandatory for group backend.
2392

2493
## Integrations
2594

26-
### WordPress
95+
The basic functionality requires only one database table: [User table](#user-table).
96+
97+
For all options to work three tables are required:
98+
- [User table](#user-table),
99+
- [Group table](#group-table),
100+
- [User group table](#user-group-table).
101+
102+
If you already have an existing database you can always create database views which fits this model,
103+
but be aware that some functionalities requires data changes (update queries).
104+
105+
If you don't have any database model yet you can use below tables (MySQL):
106+
```
107+
CREATE TABLE sql_users
108+
(
109+
id INT AUTO_INCREMENT PRIMARY KEY,
110+
username VARCHAR(16) NOT NULL,
111+
display_name TEXT NULL,
112+
email TEXT NULL,
113+
home TEXT NULL,
114+
password TEXT NOT NULL,
115+
can_change_avatar BOOLEAN NOT NULL DEFAULT FALSE,
116+
CONSTRAINT users_username_uindex UNIQUE (username)
117+
);
118+
119+
CREATE TABLE sql_group
120+
(
121+
id INT AUTO_INCREMENT PRIMARY KEY,
122+
name VARCHAR(16) NOT NULL,
123+
display_name TEXT NULL,
124+
admin BOOLEAN NOT NULL DEFAULT FALSE,
125+
CONSTRAINT group_name_uindex UNIQUE (name)
126+
);
127+
128+
CREATE TABLE sql_user_group
129+
(
130+
id INT AUTO_INCREMENT PRIMARY KEY,
131+
group_name VARCHAR(16) NOT NULL,
132+
username VARCHAR(16) NOT NULL,
133+
CONSTRAINT user_group_group_name_username_uindex UNIQUE (group_name, username),
134+
INDEX user_group_group_name_index (group_name),
135+
INDEX user_group_username_index (username)
136+
);
137+
```
138+
139+
#### WordPress
140+
27141
Thanks to this app, Nextcloud can easily integrate with Wordpress.
28142

29-
In the Nextcloud Column Settings of SQL User Backend, configure it as
143+
In the Nextcloud user table settings of SQL Backends, configure it as:
30144
```
31-
Table: wp_users
32-
Username Column: user_login
33-
Password Column: user_pass
34-
Encryption Type: Joomla > 2.5.18 phppass
145+
User table: wp_users
146+
Username column: user_login
147+
Password column: user_pass
148+
149+
Hashing algorithm: Unix (Crypt)
35150
```
36151

37-
### JHipster
38-
It is very easy to integrate Nextcloud with JHipster.
152+
#### JHipster
39153

40-
Follow the Using the Database instructions in [Using Jhipster in development](http://www.jhipster.tech/development/) to configure your database. Assume you chose MySQL as JHipster database.
154+
It is very easy to integrate Nextcloud with JHipster.
41155

42-
In the Nextcloud Column Settings of SQL User Backend, configure it as
156+
Follow the Using the Database instructions in [Using Jhipster in development](http://www.jhipster.tech/development/)
157+
to configure your database. Assume you chose MySQL as JHipster database.
158+
In the Nextcloud user table settings of SQL Backends, configure it as:
43159
```
44-
Table: jhi_users
45-
Username Column: login
46-
Password Column: password_hash
47-
Encryption Type: Joomla > 2.5.18 phppass
48-
User Activate Column: activated
49-
Email Column: email
160+
User table: jhi_users
161+
Username column: login
162+
Password column: password_hash
163+
Email column: email
164+
165+
Hashing algorithm: Unix (Crypt)
50166
```
51167

52-
## Features
53-
Currently, it supports most of postfixadmin's encryption options, except dovecot and saslauthd.
54-
It was tested and developed for a postfixadmin database.
55-
56-
Password changing is disabled by default, but can be enabled in the Admin area.
57-
Caution: user_sql does not recreate password salts, which imposes a security risk.
58-
Password salts should be newly generated whenever the password changes.
59-
60-
The column autocomplete works only for MySQL and PostgreSQL database which is used to validate form data.
61-
If you use other database use *occ* command to set the application config parameters with domain suffix.
62-
63-
For example to set 'sql_hostname' parameter in default domain use:
64-
65-
```occ config:app:set user_sql 'sql_hostname_default' --value='localhost'```
66-
67-
### Currently supported parameters
68-
69-
- sql_hostname
70-
- sql_username
71-
- sql_password
72-
- sql_database
73-
- sql_table
74-
- sql_driver
75-
- col_username
76-
- col_password
77-
- col_active
78-
- col_displayname
79-
- col_email
80-
- col_gethome
81-
- set_active_invert
82-
- set_allow_pwchange
83-
- set_default_domain
84-
- set_strip_domain
85-
- set_crypt_type
86-
- set_mail_sync_mode
87-
- set_enable_gethome
88-
- set_gethome_mode
89-
- set_gethome
90-
- sql_group_table
91-
- col_group_username
92-
- col_group_name
93-
94-
## Acknowledgments
168+
## Hash algorithms
169+
170+
Below is a table containing all of the supported hash implementations with example hashes.
171+
The hashed password is "password", the salt if required have been generated randomly.
172+
173+
Hash name | Details | Hash example value
174+
--- | --- | ---
175+
Cleartext | Never use this. Only for development. | password
176+
Courier base64-encoded MD5 | No salt supported. | {MD5RAW}5f4dcc3b5aa765d61d8327deb882cf99
177+
Courier hexadecimal MD5 | No salt supported. | {MD5}X03MO1qnZdYdgyfeuILPmQ==
178+
Courier base64-encoded SHA1 | No salt supported. | {SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=
179+
Courier base64-encoded SHA256 | No salt supported. | {SHA256}XohImNooBHFR0OVvjcYpJ3NgPQ1qq73WKhHvch0VQtg=
180+
Unix (Crypt) | See [crypt](http://php.net/manual/en/function.crypt.php). | $2y$10$5rsN1fmoSkaRy9bqhozAXOr0mn0QiVIfd2L04Bbk1Go9MjdvotwBq
181+
Argon2 (Crypt) | Requires PHP >= 7.2.<br/>Uses default parameters. See [password_hash](http://php.net/manual/en/function.password-hash.php). | $argon2i$v=19$m=1024,t=2,p=2$NnpSNlRNLlZobnJHUDh0Sw$oW5E1cfdPzLWfkTvQFUyzTR00R0aLwEdYwldcqW6Pmo
182+
Blowfish (Crypt) | Uses default parameters. See [password_hash](http://php.net/manual/en/function.password-hash.php). | $2y$10$5rsN1fmoSkaRy9bqhozAXOr0mn0QiVIfd2L04Bbk1Go9MjdvotwBq
183+
Extended DES (Crypt) | | ..UZoIyj/Hy/c
184+
MD5 (Crypt) | | $1$RzaFbNcU$u9adfTY/Q6za6nu0Ogrl1/
185+
SHA256 (Crypt) | Generates hash with 5000 rounds. | $5$rounds=5000$VIYD0iHkg7uY9SRc$v2XLS/9dvfFN84mzGvW9wxnVt9Xd/urXaaTkpW8EwD1
186+
SHA512 (Crypt) | Generates hash with 5000 rounds. | $6$rounds=5000$yH.Q0OL4qbCOUJ3q$Xry5EVFva3wKnfo8/ktrugmBd8tcl34NK6rXInv1HhmdSUNLEm0La9JnA57rqwQ.9/Bz513MD4tvmmISLUIHs/
187+
Standard DES (Crypt) | | yTBnb7ab/N072
188+
Joomla MD5 Encryption | Generates 32 chars salt. | 14d21b49b0f13e2acba962b6b0039edd:haJK0yTvBXTNMh76xwEw5RYEVpJsN8us
189+
MD5 | No salt supported. | 5f4dcc3b5aa765d61d8327deb882cf99
190+
SHA1 | No salt supported. | 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
191+
SSHA256 | Generates 32 chars salt. | {SSHA256}+WxTB3JxprNteeovsuSYtgI+UkVPA9lfwGoYkz3Ff7hjd1FSdmlTMkNsSExyR21KM3NvNTZ5V0p4WXJMUjFzUg==
192+
SSHA512 | Generates 32 chars salt. | {SSHA512}It+v1kAEUBbhMJYJ2swAtz+RLE6ispv/FB6G/ALhK/YWwEmrloY+0jzrWIfmu+rWUXp8u0Tg4jLXypC5oXAW00IyYnRVdEZJbE9wak96bkNRVWFCYmlJNWxrdTA0QmhL
193+
194+
## Development
195+
196+
#### New database driver support
197+
198+
Add a new class in the `OCA\UserSQL\Platform` namespace which extends the `AbstractPlatform` class.
199+
Add this driver in `admin.php` template to `$drivers` variable and in method `getPlatform(Connection $connection)`
200+
of `PlatformFactory` class.
201+
202+
#### New hashing algorithm support
203+
204+
Create a new class in `OCA\UserSQL\Crypto` namespace which implements `IPasswordAlgorithm` interface.
205+
Do not forget to write unit tests.
206+
207+
### Acknowledgments
208+
95209
This repository contains continuation of work done in [this repo](https://www.aboehler.at/hg/user_sql/).
210+
This plugin was heavily based on user_imap, user_pwauth, user_ldap and user_redmine!
96211

97-
This plugin is heavily based on user_imap, user_pwauth, user_ldap and user_redmine!
212+
Since version 4.0.0 the whole core implementation has been rewritten.
98213

99214
### Credits
100215

0 commit comments

Comments
 (0)